Exracting a json field data from a log

[soumyacharya91]

Hi All,

I am trying to extact a JSON field from the log. I can able to get the data by using "spath input" command. Can you help me with this command's configuration in the back end file so that it can automatically do the job.

search query :

index=*|spath input=<JSON field name>

I need to update this search in props.conf / transforms.conf.

Please find more details about it from the sample log below as I can see it's bit confusing.

"Master_field": "value", "Master_field": "{\"field1\":\"***\",\"field2\":\"value2\",\"field3\":\"value3\",\"field4\":\"value4\",\"field5\":\"{value5}\",\"field6\":\"value6\"},"Master_field": "value"}

Here is the raw data I'm getting in the events. Master fields have been parsed successfully. But the sub fields are not able to parse and they are coming under respective master field.

Using spath command in the query I am able to get the exact data but how to implement the same in the back end file to avoid using this command at search time.

Thanks,
Sam

[ddrillic]

We had the following thread about this subject at - What are the requirements for a perfect Splunk JSON document?

The following worked for us -

INDEXED_EXTRACTIONS = json
category = Structured

[soumyacharya91]

Yes, you are absolutely right we can use this to parse and index the JSON data.

[jlvix1]

I think if you have the data in splunk as sourcetype _json or json_no_timestamp you should be ok, see how this turns up in a verbose mode search and there may not be a need to use INDEXED_EXTRACTIONS=json or KV_MODE = none or spath queries.

There are issues when you have data that "contains" JSON, e.g. an exception message etc... That's when problems begin, is this the case.

[ravidudala · Accepted solution]

You can try the following in props.conf

[sourcteype]
INDEXED_EXTRACTIONS = json
KV_MODE = none

[soumyacharya91]

I tried it but still getting the same result.

[p_gurav]

Did you try putting KV_MODE=_json OR INDEXED_EXTRACTION = _json?

[soumyacharya91]

Yes, already tried KV_MODE=JSON but no luck 😞